In a promotional video for Amazon’s Echo virtual assistant device, a young girl no older than 12 asks excitedly: “Is it for me?”. The voice-controlled speaker can search the web for information, answer questions and even tell kids’ jokes. “It’s for everyone,” enthuses her on-screen dad.

Except that it isn’t. An investigation by the Guardian has found that despite Amazon marketing the Echo to families with young children, the device is likely to contravene the US Children’s Online Privacy Protection Act (COPPA), set up to regulate the collection and use of personal information from anyone younger than 13.

Along with Google, Apple and others promoting voice-activated artificial intelligence systems to young children, the company could now face multimillion-dollar fines.

“This is part of the initial wave of marketing to children using the internet of things,” says Jeff Chester, executive director of the Center for Digital Democracy, a privacy advocacy group that helped write the law. “It is exactly why the law was enacted in the first place, to protect young people from pervasive data collection.”